AU2005239707B2 - Method and system for securely provisioning a client device - Google Patents
Method and system for securely provisioning a client device Download PDFInfo
- Publication number
- AU2005239707B2 AU2005239707B2 AU2005239707A AU2005239707A AU2005239707B2 AU 2005239707 B2 AU2005239707 B2 AU 2005239707B2 AU 2005239707 A AU2005239707 A AU 2005239707A AU 2005239707 A AU2005239707 A AU 2005239707A AU 2005239707 B2 AU2005239707 B2 AU 2005239707B2
- Authority
- AU
- Australia
- Prior art keywords
- client
- computing device
- network address
- server
- server computing
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Ceased
Links
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F15/00—Digital computers in general; Data processing equipment in general
- G06F15/16—Combinations of two or more digital computers each having at least an arithmetic unit, a program unit and a register, e.g. for a simultaneous processing of several programs
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
- H04L63/0869—Network architectures or network communication protocols for network security for authentication of entities for achieving mutual authentication
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L61/00—Network arrangements, protocols or services for addressing or naming
- H04L61/50—Address allocation
- H04L61/5007—Internet protocol [IP] addresses
- H04L61/5014—Internet protocol [IP] addresses using dynamic host configuration protocol [DHCP] or bootstrap protocol [BOOTP]
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
- H04L63/0876—Network architectures or network communication protocols for network security for authentication of entities based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L69/00—Network arrangements, protocols or services independent of the application payload and not provided for in the other groups of this subclass
- H04L69/16—Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP]
- H04L69/161—Implementation details of TCP/IP or UDP/IP stack architecture; Specification of modified or new header fields
Landscapes
- Engineering & Computer Science (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Computer Hardware Design (AREA)
- Computer Security & Cryptography (AREA)
- General Engineering & Computer Science (AREA)
- Computing Systems (AREA)
- Power Engineering (AREA)
- Theoretical Computer Science (AREA)
- General Physics & Mathematics (AREA)
- Physics & Mathematics (AREA)
- Software Systems (AREA)
- Data Exchanges In Wide-Area Networks (AREA)
- Small-Scale Networks (AREA)
- Computer And Data Communications (AREA)
- Storage Device Security (AREA)
- Automobile Manufacture Line, Endless Track Vehicle, Trailer (AREA)
- Soil Working Implements (AREA)
- Communication Control (AREA)
- Circuits Of Receivers In General (AREA)
Abstract
Disclosed is a mechanism for securely provisioning a client (106) by authenticating that client during a dynamic configuration process. Rather than relying on post-configuration authentication schemes, the present invention combines security and dynamic configuration into a unified scheme. Any client device attempting to access a network (100) may request configuration information from a configuration server (104) associated with that network, but the server does not comply with the request until the client has successfully authenticated itself as a device authorized to receive configuration information for the network. The configuration server may provide the client with temporary configuration information that allows the client to proceed with the authentication process but that denies the client full access to the network. Upon successful authentication, the server may give the client new, non-temporary configuration information or may change the status of the information already given from temporary to a status giving fuller access.
Description
AUSTRALIA PATENTS ACT 1990 COMPLETE SPECIFICATION NAME OF APPLICANT(S):: Microsoft Corporation ADDRESS FOR SERVICE: DAVIES COLLISON CAVE Patent Attorneys I Nicholson Street, Melbourne, 3000, Australia INVENTION TITLE: Method and system for securely provisioning a client device The following statement is a full description of this invention, including the best method of performing it known to me/us: 5102 MS: 309788.01 Page la LVM: 230326 TECHNICAL FIELD [00011 The present invention is related generally to computer communications, and, more particularly, to remotely provisioning a client device. BACKGROUND OF THE INVENTION 100021 In the past, once a computer was configured for its working environment, that configuration rarely or never changed. In today's dynamic computing environment, however, a computer may need to change its configuration frequently. When, for example, a mobile computer moves from one wireless network to another, it might change its network address to one compatible with the new network. Also, when a computer temporarily joins an ad hoc networking group, administrative and security policies may require the computer to change its configuration to one more acceptable to the ad hoc group. In a third example, some computers change their configuration, at least their network address, every time they access the Internet through an Internet Service Provider (ISP). [0003] Protocols have been developed to support various aspects of dynamic configuration. As one example, DHCP, the Dynamic Host Configuration Protocol, provides, among other network configuration information, an IP (Internet Protocol) address to a requesting computer. DHCP uses a client-server model, where a client computer, needing an IP address, requests one of a DHCP server. The DHCP server, in some cases provided by an ISP, controls a pool of IP addresses. Upon receiving the client's request, the DHCP server performs one of three modes of address allocation. In the "automatic allocation" mode, the DHCP server chooses an unused IP address from its pool and permanently assigns it to the requesting client. In the "manual allocation" mode, a network administrator chooses the address. Most interestingly for dynamic configuration, in the "dynamic allocation" mode, the DHCP server assigns a currently unused IP address to the client, but this dynamic address is valid only for a limited period of time as set by the DHCP server or until the client explicitly gives up its use of the address. Regardless of the allocation mode used, the DHCP server responds to the client's request by informing the client of the IP address assigned to it along with, in the case of dynamic allocation, the time period of the assignment. If the DHCP server cannot provide an IP address (possibly because all of the C NRPonblDCC\C.E\2591082 1.DOC-2201/2010 -2 addresses in its pool are currently in use), then the DHCP server informs the client of this fact, and the client must wait until later to access the network. 100041 In any dynamic computing system, ease of configuration should be balanced against security concerns. Many an institution establishes a dynamic network to 5 perform the internal (that is to say, the private) work of the institution, and the institution can be compromised if an unauthorized computer is allowed to dynamically configure itself and join the network. Useful as they are, dynamic configuration protocols, including DHCP, are in general weak in the area of security. By relying heavily on post configuration processes (such as encryption-key-based authentication mechanisms) to 10 secure their network, some configuration servers inadvertently allow in rogue clients. While the post-configuration schemes usually work as advertised to limit the access and the possible harm of rogue clients, still, some harm can be done by a rogue even before it is forced to submit to, and to presumably fail, a post-configuration protection scheme. 15 SUMMARY OF THE INVENTION [0004a] According to the present invention, there is provided a computer storage medium having computer-executable instructions for performing, in a client/server computing environment, a method for securely providing a client computing device with a 20 network address, the method comprising: requesting, by the client computing device, a network address; receiving, by a server computing device, the client's request for a network address; attempting to authenticate the client computing device to the server computing device; 25 attempting to authenticate the server computing device to the client computing device; and if the client computing device is authenticated as permitted to receive a network address in the client/server computing environment and if the server computing device is authenticated as permitted to provide a network address in the client/server computing 30 environment, then: C:\NRPonbI\DCC\CLB2159 1 X2. .DOC-22/, 1/21 - 2a identifying, by the server computing device, a network address that is appropriate to the client/server computing environment and that is not currently assigned to a computing device; assigning, by the server computing device, the identified network address to the 5 client computing device; providing, by the server computing device, the assigned network address to the client computing device; and receiving, by the client computing device, the assigned network address. [0004b] The present invention also provides in a client/server computing 10 environment, a method for a server computing device to securely provide a client computing device with a network address, the method comprising: receiving a client request from a client computing device for a network address; attempting to authenticate the client computing device to the server computing device; 15 attempting to authenticate the server computing device to the client computing device; and if the client computing device is authenticated as permitted to receive a network address in the client/server computing environment and if the server computing device is authenticated as permitted to provide a network address in the client/server computing 20 environment, then: identifying a network address that is appropriate to the client/server computing environment and that is not currently assigned to a computing device; assigning the identified network address to the client computing device; and providing the assigned network address to the client computing device. 25 10004c] The present invention further provides a computer storage medium having computer-executable instructions for performing, in a client/server computing environment, a method for a client computing device to secure a network address, the method comprising: requesting a network address; 30 attempting to authenticate the client computing device to a server computing device; C:NRPonbrf\DCC\CLE\25)102 1 DOC-22/)/20110 - 2b attempting to authenticate the server computing device to the client computing device; and if the client computing device is authenticated as permitted to receive a network address in the client/server computing environment and if the server computing device is 5 authenticated as permitted to provide a network address in the client/server computing environment, then receiving an assigned network address, wherein: the assigned network address has been identified by the server computing device as a network address that is appropriate to the client/server computing environment and that is not currently assigned to a computing device; 10 the assigned network address has been assigned to the client computing device by the server computer device; and the assigned network address has been provided to the client computing device by the server computing device. [0004d] The present invention also provides a system for securely providing, in a 15 client/server computing environment, a client computing device with a network address, the system comprising: the client computing device configured for requesting a network address, for attempting to authenticate the client computing device to a server computing device, for attempting to authenticate the server computing device to the client computing device, and, 20 if the client computing device is authenticated as permitted to receive a network address in the client/server computing environment and if the server computing device is authenticated as permitted to provide a network address in the client/server computing environment, then for receiving an assigned network address; and the server computing device configured for receiving the client's request for a 25 network address, for attempting to authenticate the client computing device to the server computing device, for attempting to authenticate the server computing device to the client computing device, and, if the client computing device is authenticated as permitted to receive a network address in the client/server computing environment and if the server computing device is authenticated as permitted to provide a network address in the 30 client/server computing environment, then for identifying a network address that is appropriate to the client/server computing environment and that is not currently assigned to C\NRPorb\DCC\CLEB5Y10x2_I DOC-221fU2010 - 2c a computing device, for assigning the identified network address to the client computing device, and for providing the assigned network address to the client computing device. 10005] One embodiment of the present invention provides a mechanism for securely provisioning a client by authenticating that client during a dynamic configuration 5 process. Rather than relying on post-configuration authentication schemes, the present invention combines security and dynamic configuration into a unified scheme. 100061 Any client device attempting to access a network may request configuration information from a configuration server associated with that network, but the server does not comply with the request until the client has successfully authenticated itself as a device 10 authorized to receive configuration information for the network. In one embodiment, the configuration server may provide the client with temporary configuration information, e.g., a temporary network address, that allows the client to proceed with the authentication process but that denies the client full access to the network. Upon successful authentication, the server may give the client new, non-temporary configuration 15 information or may change the status of the information already given from temporary to a status giving fuller access. [00071 In one embodiment, the present invention uses an existing dynamic configuration protocol, such as DHCP, without the need for changing that protocol. Messages used in the MS: 309788.01 Page 3 LVM: 230326 authentication process are carried within existing configuration messages, for example within the options field in DHCP messages. [00081 In another embodiment, the present invention applies existing security protocols to a dynamic configuration environment. The Extensible Authentication Protocol (EAP), for example, can be used without modification as an authentication framework for many of the security tasks of the present invention. [00091 Combining the embodiments of the previous two paragraphs, EAP messages can be carried in the options field of DHCP messages. When a client requests configuration information, it includes within its DHCP message an EAP capability option. EAP is pursued until the client has authenticated itself to the DHCP server (and, in some scenarios, the server has authenticated itself to the client). At that point, the DHCP server can respond to the initial request by providing the requested configuration information. [0010] As part of a secured, dynamic provisioning mechanism, a configuration server can apply policies set up for the network it is serving. For example, the configuration information provided can be limited in duration or in scope. BRIEF DESCRIPTION OF THE DRAWINGS [0011] While the appended claims set forth the features of the present invention with particularity, the invention, together with its objects and advantages, may be best understood from the following detailed description taken in conjunction with the accompanying drawings of which: [0012] Figure 1 is a block diagram showing a client device attempting to join a network that is "guarded" by a secure configuration server; 10013] Figure 2 is a schematic diagram generally illustrating an exemplary computing device that supports the present invention; [00141 Figures 3a through 3c together are a logic flow diagram showing an exemplary exchange between a client and a secure configuration server; MS: 309788.01 Page 4 LVM: 230326 [0015] Figures 4a and 4b together are a communications flow diagram showing how DHCP and EAP messages can be used to implement a secure configuration scheme; and [00161 Figure 5 is a data structure diagram of an EAP message carried within the options field of a DHCP message. DETAILED DESCRIPTION OF THE INVENTION [0017] Turning to the drawings, wherein like reference numerals refer to like elements, the present invention is illustrated as being implemented in a suitable computing environment. The following description is based on embodiments of the invention and should not be taken as limiting the invention with regard to alternative embodiments that are not explicitly described herein. [0018] In the description that follows, the environment surrounding the present invention is described with reference to acts and symbolic representations of operations that are performed by one or more computing devices, unless indicated otherwise. As such, it will be understood that such acts and operations, which are at times referred to as being computer-executed, include the manipulation by the processing unit of the computing device of electrical signals representing data in a structured form. This manipulation transforms the data or maintains them at locations in the memory system of the computing device, which reconfigures or otherwise alters the operation of the device in a manner well understood by those skilled in the art. The data structures where data are maintained are physical locations of the memory that have particular properties defined by the format of the data. However, while the invention is being described in the foregoing context, it is not meant to be limiting as those of skill in the art will appreciate that various of the acts and operations described hereinafter may also be implemented in hardware. 100191 Figure 1 is useful for presenting an overview of various aspects of the present invention. A more detailed discussion follows with reference to the other figures. A secured network 100 is shown in Figure 1. Here, secured simply means that the network 100 is closed to non-authorized users. Security is enforced by a set of configuration parameters: Devices 102 already in the network 100 have the proper configuration parameters and may thus freely communicate with one another. An outsider like the configuration client 106 does not have a proper set of configuration parameters and therefore cannot communicate with these devices MS: 309788.01 Page 5 LVM: 230326 102. Because the configuration client 106 wishes to join the network 100, it seeks admission through the secure configuration server 104 that is "guarding" the network 100. As a gateway to the network 100, any outside device can freely communicate with the secure configuration server 104. 10020] Upon receiving the configuration client 106's request to join the network 100, but before providing the configuration client 106 with a proper set of configuration parameters, the secure configuration server 104 forces the configuration client 106 to authenticate itself, that is, to prove that it is a device authorized to join the network 100. How that authorization is initially set up is beyond the scope of the present discussion, but numerous methods are well known in the art. [00211 The configuration client 106 proceeds to prove its identity to the secure configuration server 104. Detailed examples of this authentication process accompany Figures 3a through 3c, 4a, 4b, and 5. In some networks, the secure configuration server also proves its identity to the requesting configuration client. This two-way, or mutual, authentication enhances the security of these networks by preventing a rogue device from impersonating the network's secure configuration server. 10022] If the authentication process completes successfully, then the secure configuration server 104 knows that the configuration client 106 is authorized to join the network 100. The secure configuration server 104 then provides an appropriate set of configuration parameters to the configuration client 106, and the configuration client 106 uses those parameters to join the network 100 and to freely communicate with the other devices 102 already in the network 100. 100231 Eventually, the configuration client 106 leaves the network 100. This may be at the discretion of the configuration client 106, or the set of configuration parameters provided to it may expire. In any case, those configuration parameters are no longer valid, and whenever the configuration client 106 wishes to rejoin the network 100, it repeats the above process. 10024] The scenario of Figure 1 is intentionally simplified in order to focus on relevant aspects of the present invention. The secure configuration server 104 of Figure 1 may in some networks actually be a configuration server working with a separate security server. Also, the MS: 309788.01 Page 6 LVM: 230326 secure configuration server 104 (of whatever description) may not actually reside within the network 100: A relay agent sitting in the network 100 may transfer configuration and authentication messages to a secure configuration server located remotely. Relay agents eliminate the necessity of having a secure configuration server on every secure network segment. [0025] The configuration client 106 and the secure configuration server 104 of Figure 1 may be of any architecture. Figure 2 is a block diagram generally illustrating an exemplary computer system that supports the present invention. The computer system of Figure 2 is only one example of a suitable environment and is not intended to suggest any limitation as to the scope of use or functionality of the invention. Neither should the client 106 nor the secure configuration server 104 be interpreted as having any dependency or requirement relating to any one or combination of components illustrated in Figure 2. The invention is operational with numerous other general purpose or special-purpose computing environments or configurations. Examples of well known computing systems, environments, and configurations suitable for use with the invention include, but are not limited to, personal computers, servers, hand-held or laptop devices, multiprocessor systems, microprocessor-based systems, set-top boxes, programmable consumer electronics, network PCs, minicomputers, mainframe computers, and distributed computing environments that include any of the above systems or devices. In their most basic configurations, the client 106 and the secure configuration server 104 typically include at least one processing unit 200 and memory 202. The memory 202 may be volatile (such as RAM), non-volatile (such as ROM or flash memory), or some combination of the two. This most basic configuration is illustrated in Figure 2 by the dashed line 204. The client 106 and the secure configuration server 104 may have additional features and functionality. For example, they may include additional storage (removable and non-removable) including, but not limited to, magnetic and optical disks and tape. Such additional storage is illustrated in Figure 2 by removable storage 206 and by non removable storage 208. Computer-storage media include volatile and non-volatile, removable and non-removable, media implemented in any method or technology for storage of information such as computer-readable instructions, data structures, program modules, or other data. Memory 202, removable storage 206, and non-removable storage 208 are all examples of computer storage media. Computer-storage media include, but are not limited to, RAM, ROM, EEPROM, flash memory, other memory technology, CD-ROM, digital versatile disks, other optical storage, magnetic cassettes, magnetic tape, magnetic disk storage, other magnetic storage devices, and MS: 309788.01 Page 7 LVM: 230326 any other media that can be used to store the desired information and that can be accessed by the client 106 or by the secure configuration server 104. Any such computer-storage media may be part of the client 106 or of the secure configuration server 104. The client 106 and the secure configuration server 104 may also contain communications channels 210 that allow them to communicate with other devices, including devices on a network 100. Communications channels 210 are examples of communications media. Communications media typically embody computer-readable instructions, data structures, program modules, or other data in a modulated data signal such as a carrier wave or other transport mechanism and include any information delivery media. The tern "modulated data signal" means a signal that has one or more of its characteristics set or changed in such a manner as to encode information in the signal. By way of example, and not limitation, communications media include optical media, wired media, such as wired networks and direct-wired connections, and wireless media such as acoustic, RF, infrared, and other wireless media. The term "computer-readable media" as used herein includes both storage media and communications media. The client 106 and the secure configuration server 104 may also have input devices 212 such as a touch-sensitive display screen, a hardware keyboard, a mouse, a voice-input device, etc. Output devices 214 include the devices themselves, such as the touch-sensitive display screen, speakers, and a printer, and rendering modules (often called "adapters") for driving these devices. All these devices are well know in the art and need not be discussed at length here. The client 106 and the secure configuration server 104 each has a power supply 216. 100261 Going deeper than the overview of Figure 1, Figures 3a through 3c provide details of exemplary secure configuration schemes according to the present invention. For illustrative purposes, the logic flow diagram of these figures includes options and variations that might not apply in a given embodiment. In particular, the steps in the figures represent logical tasks and do not necessarily correspond one-to-one with individual messages. More specific details of a particular embodiment, including message exchanges and message formats, is discussed in relation to Figures 4a, 4b, and 5. 100271 The logic of Figure 3a begins in step 300 when the configuration client 106 requests from the secure configuration server 104 a set of configuration parameters that are valid for use on the network 100. Rather than immediately complying with the request, the secure MS: 309788.01 Page 8 LVM: 230326 configuration server 104 in step 302 asks the configuration client 106 to authenticate itself. In some embodiments (see specifically step 400 of Figure 4a), the configuration client 106 does not wait for the secure configuration server 104 to request authentication; instead, the configuration client 106 begins the authentication process concurrently with its initial configuration request. [00281 There are some network configurations in which the configuration client 106 needs to use a valid set of configuration parameters in order to continue communicating with the secure configuration server 104. This is somewhat of a Catch-22: For security reasons, the secure configuration server 104 does not want to provide valid configuration information to the configuration client 106 until the client 106 has authenticated itself as a device authorized to receive such information, but the authentication procedure cannot proceed until the client 106 has a set of valid parameters. Steps 304 and 306 present one way out of this dilemma, for some embodiments of the present invention. In step 304, the secure configuration server 104 provides a valid set of configuration parameters to the configuration client 106 so that the client 106 can continue the authentication process. However, the provided configuration information, while valid, is "temporary" and is only useful during authentication. For example, the configuration information can include an IP address that marks the user of the address as not fully authenticated. In step 306, the configuration client 106 receives the temporary configuration information and will use it during the remainder of the authentication process. In some instances, the temporary configuration information prevents the configuration client 106 from conversing with any device in the network 100 other than the secure configuration server 104: The configuration client 106 is said to be in "quarantine." 10029] In step 308, the configuration client 106 and the secure configuration server 104 proceed through the authentication process. Many such authentication processes are well known in the art, and any of them can be used here. In some embodiments, the particular authentication process to be used is negotiated between the configuration client 106 and the secure configuration server 104. As mentioned above in relation to Figure 1, the authentication process may be mutual with the configuration client 106 and the secure configuration server 104 each authenticating itself to the other.
MS: 309788.01 Page 9 LVM: 230326 [00301 If the authentication process fails, then, of course, the configuration client 106 is denied access to the network 100. If the configuration client 106 received temporary configuration information in step 306, the network 100 is still secure because of the limited use to which that information can be put. If the authentication process succeeds, then in step 310 of Figure 3b the secure configuration server 104 applies policies in place in the network 100, if any, to decide how to provide the requested configuration information. These policies may, for example, limit the duration or scope of use of the configuration information (e.g., that information is only valid for a one-hour "lease"). [0031] If possible, then in step 312 the secure configuration server 104 provides the requested configuration information to the configuration client 106, along with information on any limitations on use set by policy in step 310. Of course, if the network 100 has exhausted the resources needed to fulfill the request (e.g., all of the assignable IP addresses are already in use), then the configuration process fails even though the authentication process succeeded. In some embodiments, resource availability is checked before proceeding through the authentication process, and the secure configuration server 104 can deny the configuration request on that basis instead of beginning the authentication process in step 302. However, this is not preferred because it provides confidential information (that the network 100 is low on resources) to a configuration client 106 that has not been authenticated and that might be able to use the information to the detriment of the network 100. 100321 Step 314 notes that if the configuration client 106 was provided with temporary configuration information in step 304, then, in some embodiments, the secure configuration server 104 may choose to simply change the status of that information to non-temporary rather than sending a new set of configuration parameters. The effect is the same in either case. 10033] With authentication complete and with the non-temporary configuration information in hand, the configuration client 106 is now a device on the network 100 and, in step 316 of Figure 3c, can communicate with the other devices 102 (subject to whatever policy limitations were imposed on the provided configuration information). This continues until step 318 where the configuration client 106 either chooses to relinquish the provided configuration information, or a lease on the information expires. In the later case, the secure configuration server 104 marks MS: 309788.01 Page 10 LVM: 230326 the provided configuration information as invalid. In either case, the client 106 exits the network 100 and, if it wishes to continue communicating, repeats the secure configuration process (step 320). [00341 The discussion accompanying Figures 3a through 3c is kept at a high level to illustrate the breadth of application of the present invention (which is, however, ultimately defined by the scope of the claims and not by any illustrations in this specification). To further the discussion, Figures 4a and 4b present a specific embodiment of the invention. [0035] While, in general, either party can initiate the secure configuration process, in step 400 of Figure 4a the configuration client 106 initiates the process by sending a DHCP Discover. message to the secure configuration server 104. This DHCP message contains the configuration client 106's request for configuration information. Carried within the options field of the DHCP Discover message is a notice that the configuration client 106 is prepared to use EAP to authenticate itself. These two protocols, DHCP and EAP, are well known in the art, and so their details need not be discussed here. They are defined, respectively, in the Requests for Comments 2131 and 3748 of the Internet Engineering Task Force, which are incorporated herein in their entireties by reference. 100361 Because the secure configuration server 104 will not provide configuration information to an un-authenticated client, it responds in step 402 with a DHCP Offer message containing within its options field an EAP message requesting the identity of the configuration client 106. The configuration client 106 responds in step 404 by sending an EAP message containing its identity. The EAP message is, once again, contained within the options field of a DHCP message. [0037] EAP allows the configuration client 106 and the secure configuration server 104 to negotiate and to use any of a number of authentication mechanisms. In steps 406 and 408, the two parties proceed through the details of EAP and of the authentication mechanism they have chosen. In some embodiments, EAP need not be altered in any way for the purposes of the present invention, and so the details of EAP known in the art apply as well here. In steps 406 and 408, as in the previous steps of Figure 4a, EAP messages are carried within the options fields of DHCP messages.
MS: 309788.01 Page 11 LVM: 230326 [0038] If the authentication process proceeds to a successful conclusion, then the secure configuration server 104 accepts the authenticity of the configuration client 106, and, in step 410 of Figure 4b, sends an EAP Success message carried in the options field of a DHCP ACK message. That DHCP message also includes the requested configuration information. [0039] When the configuration client 106 has completed its work with the network 100, it relinquishes the configuration information by sending a DHCP Release message in step 412. [0040] Figure 5 is an exemplary data structure diagram of a DHCP message 500 containing, within its options field 502, an EAP message 504. The heart of the EAP message is its data field 506. By combining a well known configuration protocol, DHCP, with a well known authentication framework protocol, EAP, embodiments of the present invention provide security to the configuration process without requiring any changes to either protocol. [0041] In view of the many possible embodiments to which the principles of the present invention may be applied, it should be recognized that the embodiments described herein with respect to the drawing figures are meant to be illustrative only and should not be taken as limiting the scope of the invention. Those of skill in the art will recognize that some implementation details, such as configuration and authentication protocols, are determined by specific situations. Although the environment of the invention is described in terms of software modules or components, some processes may be equivalently performed by hardware components. Therefore, the invention as described herein contemplates all such embodiments as may come within the scope of the following claims and equivalents thereof. Throughout this specification and the claims which follow, unless the context requires otherwise, the word "comprise", and variations such as "comprises" or "comprising", will be understood to imply the inclusion of a stated integer or step or group of integers or steps but not the exclusion of any other integer or step or group of integers or steps. The reference to any prior art in this specification is not, and should not be taken as, an acknowledgment or any form of suggestion that that prior art forns part of the common general knowledge in Australia.
Claims (13)
1. A computer storage medium having computer-executable instructions for performing, in a client/server computing environment, a method for securely providing a 5 client computing device with a network address, the method comprising: requesting, by the client computing device, a network address; receiving, by a server computing device, the client's request for a network address; attempting to authenticate the client computing device to the server computing device; 10 attempting to authenticate the server computing device to the client computing device; and if the client computing device is authenticated as permitted to receive a network address in the client/server computing environment and if the server computing device is authenticated as permitted to provide a network address in the client/server computing 15 environment, then: identifying, by the server computing device, a network address that is appropriate to the client/server computing environment and that is not currently assigned to a computing device; assigning, by the server computing device, the identified network address to the 20 client computing device; providing, by the server computing device, the assigned network address to the client computing device; and receiving, by the client computing device, the assigned network address. 25
2. In a client/server computing environment, a method for a server computing device to securely provide a client computing device with a network address, the method comprising: receiving a client request from a client computing device for a network address; attempting to authenticate the client computing device to the server computing 30 device; C:\NRPonbrDCCCLE23591$2_L.DOC-22A1(2010 - 13 attempting to authenticate the server computing device to the client computing device; and if the client computing device is authenticated as permitted to receive a network address in the client/server computing environment and if the server computing device is 5 authenticated as permitted to provide a network address in the client/server computing environment, then: identifying a network address that is appropriate to the client/server computing environment and that is not currently assigned to a computing device; assigning the identified network address to the client computing device; and 10 providing the assigned network address to the client computing device.
3. The method of claim 2 in which the assigned network address is an IP address.
4. The method of claim 2 in which attempting to authenticate comprises using EAP. 15
5. The method of claim 4 in which EAP messages are carried in DHCP options fields.
6. The method of claim 2 in which attempting to authenticate is initiated by the server computing device. 20
7. The method of claim 2 in which identifying a network address is performed even if the client computing device is not authenticated as permitted to receive a network address in the client/server computing environment. 25
8. The method of claim 2 further comprising: assigning a temporary network address to the client computing device for use during the attempt to authenticate.
9. The method of claim 8 in which, if the client computing device is authenticated as permitted to receive a network address in the client/server computing environment, then 30 the assigned network address is the same as the temporary network address. C:\NRPonbl\DCC\CLE259 OX2. 1. DOC-2210 [2O 10 -14
10. A computer storage medium having computer-executable instructions for performing, in a client/server computing environment, a method for a client computing device to secure a network address, the method comprising: requesting a network address; 5 attempting to authenticate the client computing device to a server computing device; attempting to authenticate the server computing device to the client computing device; and if the client computing device is authenticated as permitted to receive a network 10 address in the client/server computing environment and if the server computing device is authenticated as permitted to provide a network address in the client/server computing environment, then receiving an assigned network address, wherein: the assigned network address has been identified by the server computing device as a network address that is appropriate to the client/server computing environment and that is 15 not currently assigned to a computing device; the assigned network address has been assigned to the client computing device by the server computer device; and the assigned network address has been provided to the client computing device by the server computing device. 20
11. A system for securely providing, in a client/server computing environment, a client computing device with a network address, the system comprising: the client computing device configured for requesting a network address, for attempting to authenticate the client computing device to a server computing device, for 25 attempting to authenticate the server computing device to the client computing device, and, if the client computing device is authenticated as permitted to receive a network address in the client/server computing environment and if the server computing device is authenticated as permitted to provide a network address in the client/server computing environment, then for receiving an assigned network address; and 30 the server computing device configured for receiving the client's request for a network address, for attempting to authenticate the client computing device to the server C\NRPonbKlDCC\CLE\l59102I DOC-221/21I10 - 15 computing device, for attempting to authenticate the server computing device to the client computing device, and, if the client computing device is authenticated as permitted to receive a network address in the client/server computing environment and if the server computing device is authenticated as permitted to provide a network address in the 5 client/server computing environment, then for identifying a network address that is appropriate to the client/server computing environment and that is not currently assigned to a computing device, for assigning the identified network address to the client computing device, and for providing the assigned network address to the client computing device. 10
12. The system of claim 11 in which the assigned network address is on IP address.
13. A computer storage medium, or a system, substantially as hereinbefore described with reference to the accompanying drawings.
Applications Claiming Priority (2)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
US11/007,122 US7558866B2 (en) | 2004-12-08 | 2004-12-08 | Method and system for securely provisioning a client device |
US11/007,122 | 2004-12-08 |
Publications (2)
Publication Number | Publication Date |
---|---|
AU2005239707A1 AU2005239707A1 (en) | 2006-06-22 |
AU2005239707B2 true AU2005239707B2 (en) | 2010-02-25 |
Family
ID=35759413
Family Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
AU2005239707A Ceased AU2005239707B2 (en) | 2004-12-08 | 2005-12-01 | Method and system for securely provisioning a client device |
Country Status (14)
Country | Link |
---|---|
US (1) | US7558866B2 (en) |
EP (1) | EP1670215B1 (en) |
JP (1) | JP4673734B2 (en) |
KR (1) | KR101159355B1 (en) |
CN (1) | CN1832490B (en) |
AT (1) | ATE410020T1 (en) |
AU (1) | AU2005239707B2 (en) |
BR (1) | BRPI0505394B1 (en) |
CA (1) | CA2529230C (en) |
DE (1) | DE602005010033D1 (en) |
MY (1) | MY148705A (en) |
RU (1) | RU2390828C2 (en) |
TW (1) | TWI405088B (en) |
ZA (1) | ZA200509936B (en) |
Families Citing this family (24)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US7237257B1 (en) * | 2001-04-11 | 2007-06-26 | Aol Llc | Leveraging a persistent connection to access a secured service |
US20090125958A1 (en) | 2005-11-23 | 2009-05-14 | Pak Siripunkaw | Method of upgrading a platform in a subscriber gateway device |
US8745253B2 (en) * | 2006-03-08 | 2014-06-03 | Alcatel Lucent | Triggering DHCP actions from IEEE 802.1x state changes |
US7831997B2 (en) * | 2006-06-22 | 2010-11-09 | Intel Corporation | Secure and automatic provisioning of computer systems having embedded network devices |
CN101132629B (en) * | 2006-08-25 | 2010-07-14 | 华为技术有限公司 | Method and system for discovering entrance of call control system |
US8216221B2 (en) | 2007-05-21 | 2012-07-10 | Estech, Inc. | Cardiac ablation systems and methods |
US8006193B2 (en) * | 2007-10-03 | 2011-08-23 | Microsoft Corporation | Web service user experience without upfront storage expense |
US8108911B2 (en) * | 2007-11-01 | 2012-01-31 | Comcast Cable Holdings, Llc | Method and system for directing user between captive and open domains |
US9178857B2 (en) * | 2007-11-19 | 2015-11-03 | Verizon Patent And Licensing Inc. | System and method for secure configuration of network attached devices |
EP2088734A1 (en) * | 2008-02-07 | 2009-08-12 | Nokia Siemens Networks Oy | Method and device for data processing and communication system comprising such device |
JP5029994B2 (en) * | 2008-03-24 | 2012-09-19 | Necアクセステクニカ株式会社 | COMMUNICATION SYSTEM, COMMUNICATION DEVICE, ADDRESS ALLOCATION DEVICE, COMMUNICATION CONTROL METHOD, AND COMMUNICATION CONTROL PROGRAM |
US8661252B2 (en) * | 2008-06-20 | 2014-02-25 | Microsoft Corporation | Secure network address provisioning |
JP4710966B2 (en) * | 2008-12-12 | 2011-06-29 | コニカミノルタビジネステクノロジーズ株式会社 | Image processing apparatus, image processing apparatus control method, and image processing apparatus control program |
CN102148712B (en) * | 2011-04-21 | 2014-05-14 | 天讯天网(福建)网络科技有限公司 | Cloud computing-based service management system |
US9143937B2 (en) | 2011-09-12 | 2015-09-22 | Qualcomm Incorporated | Wireless communication using concurrent re-authentication and connection setup |
US8837741B2 (en) | 2011-09-12 | 2014-09-16 | Qualcomm Incorporated | Systems and methods for encoding exchanges with a set of shared ephemeral key data |
US9439067B2 (en) | 2011-09-12 | 2016-09-06 | George Cherian | Systems and methods of performing link setup and authentication |
US9690638B2 (en) * | 2011-09-29 | 2017-06-27 | Oracle International Corporation | System and method for supporting a complex message header in a transactional middleware machine environment |
US9054874B2 (en) | 2011-12-01 | 2015-06-09 | Htc Corporation | System and method for data authentication among processors |
WO2013090940A1 (en) * | 2011-12-16 | 2013-06-20 | Huawei Technologies Co., Ltd. | System and method for concurrent address allocation and authentication |
US9055611B2 (en) * | 2012-12-21 | 2015-06-09 | Broadcom Corporation | Resilient peer network with 802.11 technology |
JP6334940B2 (en) * | 2014-02-12 | 2018-05-30 | キヤノン株式会社 | COMMUNICATION DEVICE, COMMUNICATION DEVICE CONTROL METHOD, AND PROGRAM |
US10367848B2 (en) | 2014-09-25 | 2019-07-30 | Nec Corporation | Transmitting relay device identification information in response to broadcast request if device making request is authorized |
US10805291B2 (en) * | 2015-09-11 | 2020-10-13 | Comcast Cable Communications, Llc | Embedded authentication in a service provider network |
Citations (1)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US6393484B1 (en) * | 1999-04-12 | 2002-05-21 | International Business Machines Corp. | System and method for controlled access to shared-medium public and semi-public internet protocol (IP) networks |
Family Cites Families (18)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US6643696B2 (en) * | 1997-03-21 | 2003-11-04 | Owen Davis | Method and apparatus for tracking client interaction with a network resource and creating client profiles and resource database |
US6412025B1 (en) | 1999-03-31 | 2002-06-25 | International Business Machines Corporation | Apparatus and method for automatic configuration of a personal computer system when reconnected to a network |
US6684243B1 (en) | 1999-11-25 | 2004-01-27 | International Business Machines Corporation | Method for assigning a dual IP address to a workstation attached on an IP data transmission network |
US6643694B1 (en) * | 2000-02-09 | 2003-11-04 | Michael A. Chernin | System and method for integrating a proxy server, an e-mail server, and a DHCP server, with a graphic interface |
AU2001247295A1 (en) * | 2000-03-07 | 2001-09-17 | General Instrument Corporation | Authenticated dynamic address assignment |
US7065578B2 (en) * | 2000-03-20 | 2006-06-20 | At&T Corp. | Service selection in a shared access network using policy routing |
US6792474B1 (en) * | 2000-03-27 | 2004-09-14 | Cisco Technology, Inc. | Apparatus and methods for allocating addresses in a network |
US6618757B1 (en) * | 2000-05-17 | 2003-09-09 | Nortel Networks Limited | System and method for dynamic IP address management |
JP3447687B2 (en) * | 2000-10-13 | 2003-09-16 | 日本電気株式会社 | Wireless network system and network address assignment method |
US20020138635A1 (en) | 2001-03-26 | 2002-09-26 | Nec Usa, Inc. | Multi-ISP controlled access to IP networks, based on third-party operated untrusted access stations |
US6728718B2 (en) | 2001-06-26 | 2004-04-27 | International Business Machines Corporation | Method and system for recovering DHCP data |
JP2003224577A (en) * | 2001-10-05 | 2003-08-08 | Toyo Commun Equip Co Ltd | Internet repeater |
JP2003152731A (en) * | 2001-11-16 | 2003-05-23 | Mitsumi Electric Co Ltd | Communication device, ip address acquisition method, and roaming method |
WO2003094438A1 (en) * | 2002-05-01 | 2003-11-13 | Telefonaktiebolaget Lm Ericsson (Publ) | System, apparatus and method for sim-based authentication and encryption in wireless local area network access |
JP4023240B2 (en) * | 2002-07-10 | 2007-12-19 | 日本電気株式会社 | User authentication system |
ATE291321T1 (en) * | 2002-12-20 | 2005-04-15 | Cit Alcatel | METHOD AND DEVICE FOR AUTHENTICATING A USER |
JP2004247955A (en) | 2003-02-13 | 2004-09-02 | Toshiba Solutions Corp | Communication system and communication method |
CN100499483C (en) * | 2003-11-07 | 2009-06-10 | 华为技术有限公司 | Method for implementing unified dynamic address allocation for users of different types |
-
2004
- 2004-12-08 US US11/007,122 patent/US7558866B2/en not_active Expired - Fee Related
-
2005
- 2005-12-01 AU AU2005239707A patent/AU2005239707B2/en not_active Ceased
- 2005-12-05 EP EP05111673A patent/EP1670215B1/en not_active Not-in-force
- 2005-12-05 AT AT05111673T patent/ATE410020T1/en not_active IP Right Cessation
- 2005-12-05 DE DE602005010033T patent/DE602005010033D1/en active Active
- 2005-12-05 TW TW094142831A patent/TWI405088B/en not_active IP Right Cessation
- 2005-12-06 BR BRPI0505394-3A patent/BRPI0505394B1/en not_active IP Right Cessation
- 2005-12-07 ZA ZA200509936A patent/ZA200509936B/en unknown
- 2005-12-07 RU RU2005138105/09A patent/RU2390828C2/en not_active IP Right Cessation
- 2005-12-07 MY MYPI20055710A patent/MY148705A/en unknown
- 2005-12-07 KR KR1020050118811A patent/KR101159355B1/en active IP Right Grant
- 2005-12-07 CA CA2529230A patent/CA2529230C/en not_active Expired - Fee Related
- 2005-12-08 CN CN2005101290820A patent/CN1832490B/en not_active Expired - Fee Related
- 2005-12-08 JP JP2005354885A patent/JP4673734B2/en not_active Expired - Fee Related
Patent Citations (1)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US6393484B1 (en) * | 1999-04-12 | 2002-05-21 | International Business Machines Corp. | System and method for controlled access to shared-medium public and semi-public internet protocol (IP) networks |
Non-Patent Citations (2)
Title |
---|
GUDMUNDSSON, 'Security Architecture for DHCP', IETF Standard Working Draft, 30 July 1997, Vol. dhc, No. 1 * |
JAYARAM et al., 'PANA Framework', IETF Standard Working Draft, 16 July 2004, Vol. pana, No. 1 * |
Also Published As
Publication number | Publication date |
---|---|
MY148705A (en) | 2013-05-31 |
AU2005239707A1 (en) | 2006-06-22 |
JP2006191552A (en) | 2006-07-20 |
TW200629085A (en) | 2006-08-16 |
US20060123118A1 (en) | 2006-06-08 |
EP1670215B1 (en) | 2008-10-01 |
ATE410020T1 (en) | 2008-10-15 |
CA2529230C (en) | 2016-05-31 |
EP1670215A1 (en) | 2006-06-14 |
TWI405088B (en) | 2013-08-11 |
RU2005138105A (en) | 2007-06-20 |
RU2390828C2 (en) | 2010-05-27 |
BRPI0505394A (en) | 2006-09-12 |
KR20060064544A (en) | 2006-06-13 |
ZA200509936B (en) | 2008-05-28 |
JP4673734B2 (en) | 2011-04-20 |
CN1832490A (en) | 2006-09-13 |
CN1832490B (en) | 2010-12-29 |
KR101159355B1 (en) | 2012-06-25 |
DE602005010033D1 (en) | 2008-11-13 |
CA2529230A1 (en) | 2006-06-08 |
BRPI0505394B1 (en) | 2018-01-16 |
US7558866B2 (en) | 2009-07-07 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
AU2005239707B2 (en) | Method and system for securely provisioning a client device | |
JP4805389B2 (en) | Network environment detection | |
CN102047262B (en) | Authentication for distributed secure content management system | |
JP5199405B2 (en) | Authentication in communication systems | |
US7574603B2 (en) | Method of negotiating security parameters and authenticating users interconnected to a network | |
CN101567878B (en) | Method for improving safety of network ID authentication | |
US20120311660A1 (en) | SYSTEM AND METHOD FOR MANAGING IPv6 ADDRESS AND ACCESS POLICY | |
WO2014120621A2 (en) | Securing communication over a network using client integrity verification | |
JP2003532185A (en) | Security link management in dynamic networks | |
JP2009538478A (en) | Policy-driven credentials delegation for single sign-on and secure access to network resources | |
CN101986598B (en) | Authentication method, server and system | |
JP2008005434A (en) | Communication control device, communication control method, and communication control program | |
CN113039745B (en) | File system server, method applied to file system server, and computer-readable medium | |
EP1927254B1 (en) | Method and a device to suspend the access to a service | |
US20030226037A1 (en) | Authorization negotiation in multi-domain environment | |
EP1619822A1 (en) | Delegation protocol | |
US8250640B1 (en) | Transparent kerboros delegation with a storage virtualization system | |
JP4733706B2 (en) | Secure session transfer method and corresponding terminal device | |
CN112565209B (en) | Network element equipment access control method and equipment | |
KR20060133489A (en) | Fast data-link connection method for saving connection time in cdma 2000 network | |
JP4796977B2 (en) | Remote access method, network connection setting method, and remote access system | |
JP2005086452A (en) | Connection control method and program for network device | |
CN116827639A (en) | Threat information processing method and system based on mixed blockchain and electronic equipment | |
CN114531348A (en) | Network communication method, device, terminal and storage medium based on zero trust technology | |
WO2002084970A2 (en) | System enabling remote access of a computing system |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
FGA | Letters patent sealed or granted (standard patent) | ||
PC | Assignment registered |
Owner name: MICROSOFT TECHNOLOGY LICENSING, LLC Free format text: FORMER OWNER WAS: MICROSOFT CORPORATION |
|
MK14 | Patent ceased section 143(a) (annual fees not paid) or expired |